Can a Registrar Hold Your Domain Hostage?

A registrar cannot keep your domain against your will, but it can slow your exit in specific ways. ICANN's Transfer Policy lets a registrar deny a transfer only for listed reasons, such as fraud, a 60-day lock or unpaid fees for the current term. Anything outside that list is a violation you can report to ICANN.

A woman opened her email to a $200 invoice labeled "domain unlock and transfer processing fee." She had not agreed to it. Pay it, her registrar told her, or wait another 60 days.

What happened to her is not a scam, exactly. It happens inside legal gray areas, and it is more common than the domain industry wants you to know. Some holds are legitimate fraud protection. Others are revenue mechanisms with a security label on them.

The rules draw a sharper line between the two than most registrars' support pages do. This article sorts what a registrar can legitimately do from what it can't, and gives you the steps to take when yours crosses the line.

Can a registrar really hold your domain hostage?

Not indefinitely, and not at will. Your registrar manages your account, but how a domain moves between registrars is governed by ICANN's Transfer Policy, which was last updated on February 21, 2024. The policy lets a registrar deny a transfer "only in the following specific instances," and it puts a five-calendar-day clock on releasing your transfer code when you have no way to generate it yourself.

That makes "hostage" half right. A registrar can lock, delay, charge and, in a handful of situations, legitimately block you. The word fits when a registrar stalls past the clocks or invents reasons that are not on the list. It does not fit a 60-day lock or a UDRP freeze, which exist for reasons the registrar did not make up.

One scope note before the details. The Transfer Policy covers generic top-level domains such as .com, .net and .org. ICANN says it has no contractual authority over country-code domains such as .us, .eu or .ac, so for those the registry's own rules and your registrar's terms decide. Everything below is about generic domains unless it says otherwise.

What can a registrar legitimately do, and what can't it?

Why can't I transfer my domain? How do the 60-day locks work?

Two different rules produce a 60-day wait, and registrars rarely explain which one you hit. The first applies to new and recently moved domains. The second follows a change to who the domain belongs to.

Which changes start a 60-day lock?

Routine edits are where long-time customers get caught. Updating the email on a domain so the transfer code reaches you is a change to the registrant's email address, and it can start the lock. Correcting "oJhn Smith" to "John Smith" does not.

ICANN's own registrant guidance says some registrars offer an opt-out from the 60-day lock, and that the registrar does not have to. The opt-out has to be requested before the change. If you may move a domain in the next few months, ask your registrar about it in writing before you edit anything. The full walkthrough of a clean move, including DNS and email, is in how to transfer a domain without breaking everything.

Are the 60-day locks going away?

Possibly. In March 2025 the GNSO Council, the body that sets policy for generic domains, approved the final report of its Transfer Policy Review: 47 recommendations. The working group recommended cutting the lock after registration or a registrar transfer from 60 days to 30, and removing the lock that follows a registrant change, according to ICANN's public comment summary. The ICANN Board opened public comment from April 28 to June 16, 2025, and decides whether to adopt the recommendations.

As of October 6, 2026, ICANN's policy page still shows the version updated February 21, 2024, and we found no Board decision on the recommendations. Until a new policy takes effect, the rules in the table above apply.

Which registrar "hostage tactics" are legitimate, and which break the rules?

Five practices come up whenever people describe being held hostage by a registrar. Sorted against the policy, two can break ICANN's rules. Two are violations outright, two are fine unless handled in a specific way, and one is mandatory.

Can a paid domain protection product block your transfer?

Registrars sell products with names like Domain Protection that lock a domain against unauthorized transfers. A lock that does its job also slows you down when you leave on purpose. That is a feature you paid for, not a hostage tactic.

The risk is in the removal. The Transfer Policy says a registrar may not use a mechanism to remove the transfer lock or release the code that is "more restrictive than the mechanisms used for changing any aspect of the Registered Name Holder's contact or name server information." If changing your email takes one click and lifting your protection takes a support ticket, that mismatch is what to challenge. Read what disabling a protection product involves before you buy it. Whether the paid tier is worth buying at all is covered in WHOIS privacy and domain protection: what's free and what's a scam.

Can a registrar charge a redemption fee on an expired domain?

Yes. ICANN's policy gives registrants a 30-day Redemption Grace Period after a domain is deleted. During it the registry disables DNS resolution and prohibits transfers, so the domain has to be restored through the registrar that holds it before it can move, which ICANN says may carry an additional fee. Registrars must display that fee clearly, and ICANN's advisory on restoration fees says charging an unposted fee is a breach. The policy does not cap the amount.

The amounts vary by registrar and TLD. Namecheap's redemption pricing table lists $88.48 for .com, and its support article says the fee is set by its upstream registrar and the registry. Cloudflare says a restore fee applies in most cases, varies by TLD and is separate from the renewal fee. GoDaddy's registration agreement says grace periods are not guaranteed and are subject to the registry's rules.

The practical lesson is that reminders are your job, not only the registrar's. ICANN requires at least two renewal reminders before expiry and one within five days after, but an email that lands in spam or goes to an old address still costs you the fee. The full timeline is in what happens when a domain expires, day by day.

How long does a registrar have to give you the transfer code?

Five calendar days from your request, if the registrar gives you no way to generate the code and unlock the domain yourself. Where the dashboard has a self-service option, that clock does not apply. Either way, the registrar may not refuse the code or the unlock solely because you and it are in a payment dispute. ICANN tells registrants that if the registrar does not unlock the domain or give you a reasonable method within five days, you can submit a transfer complaint.

Two snags are worth knowing. The code goes to the contact on file, and if that address is dead, fixing it is a change to the registrant's email that can start a 60-day lock. Raise it in your written request and ask how the registrar will verify you. And make the request in writing: an email gives you a timestamp for the five-day clock.

Can a registrar put your transfer in "administrative review"?

Some registrars add review windows of their own, so a transfer sits for days or weeks. The Transfer Policy has no such step, and its list of reasons to deny a transfer is closed: a registrar may deny "only in the following specific instances." Once the gaining registrar submits the transfer, the losing registrar has five calendar days to respond to the registry's notice, and silence gives default approval.

If the losing registrar does deny, ICANN says it must give the gaining registrar a notice and a specific reason. Ask the gaining registrar what reason it received. A review that applies only to outbound transfers adds friction without protecting you, which is why a registrar's exit terms belong in the price you compare.

Does a UDRP complaint freeze your domain?

Yes, and the registrar has no choice. The Uniform Domain-Name Dispute-Resolution Policy (UDRP) lets a trademark owner ask an ICANN-approved provider, such as WIPO, to cancel or transfer a domain in a generic top-level domain. The complainant must prove three things under paragraph 4(a) of the policy: the domain is identical or confusingly similar to its trademark, you have no rights or legitimate interests in it, and it was registered and is being used in bad faith. The remedies are limited to cancellation or transfer, and WIPO's guide says a panel cannot award damages.

Within two business days of the provider's verification request, the registrar must confirm it has locked the domain, which blocks changes to the registrant and registrar information. You cannot move the domain to another registrar while the case is pending. You have 20 days from the start of the proceeding to respond, a panel should decide within 14 days of its appointment, and WIPO says a case normally finishes within two months. If the panel orders a transfer, the registrar waits ten business days before acting, unless it receives proof that you have filed a court action.

A weak complaint can still lock you for the length of the case. The Rules let a panel declare a complaint brought in bad faith, including an attempt at Reverse Domain Name Hijacking, and that declaration is their answer to it. Filing is not free for the complainant either: WIPO lists a fee of USD 1,500 for one to five domains decided by a single panelist. If you hold names that resemble brands, this is the one hold you cannot talk your registrar out of.

What does ICANN actually protect you from?

ICANN enforces its contracts with registrars. It is not a referee for every dispute, and the gap between the two is where most registrants get surprised.

The rules set a floor. They don't guarantee a clean experience. For what a registration does and does not make you the owner of, read do you actually own your domain.

What should you check about a registrar before you register?

The time to test a registrar's exit is before you need it. Five checks cover it.

1. Can you unlock the domain and generate the transfer code yourself? Self-service takes you outside the five-day clock entirely. Find the button in the dashboard now, not during a deadline.
2. Does the registrar offer the opt-out from the 60-day registrant-change lock? ICANN does not require it. Ask support, in writing, before you register.
3. Are redemption and transfer-out fees posted? Registrars must display redemption fees. A transfer-out fee is allowed, and a transfer cannot be denied for not paying it. It is not a deal-breaker, but it is a signal about how the registrar thinks about your exit.
4. What does the move in cost? A transfer is not free. Cloudflare explains that most registries require every transfer to include at least one more year of registration, which it charges at cost, with no markup, and adds to your current expiration date. Compare what the registrar you are moving to charges for that year.
5. What do other customers report? Search the registrar's name with phrases like "transfer refused" and "won't release domain" on Reddit and Hacker News. One post is noise. A pattern across years is a signal.

If you are choosing a registrar for names you plan to hold for years, the best domain registrars for long-term ownership compares registrars for domains you plan to keep.

What should you do right now if your registrar is blocking a transfer?

Work in this order. Each step builds the record that the next one needs.

1. Find out which lock you are under. Check your domain's status in your registrar's dashboard or in a registration-data lookup such as ICANN's lookup tool. The status clientTransferProhibited is set by the registrar and tells the registry to reject transfer requests. Then compare the domain's creation date, last transfer and last registrant change against the 60-day rules above.
2. Ask for the unlock and the transfer code in writing. An email gives you a timestamp for the five-day clock. If the dashboard has self-service, use it and keep a screenshot.
3. Ask which policy reason applies. If the registrar refuses, ask it to name the reason and the section of the Transfer Policy. The losing registrar must give the gaining registrar a specific reason for a denial, so ask the gaining registrar what it received.
4. After five calendar days, file an ICANN transfer complaint. The trigger is a registrar that has not unlocked the domain or given you a reasonable way to unlock it.
5. Keep money on a separate track. Pay what you owe for the current term. Dispute the rest through your card issuer, not through ICANN.
6. Keep the domain renewed. An expired domain moves into redemption, where transfers are prohibited until you restore it through your current registrar, usually for a fee. A lapse during a dispute hands the registrar leverage it did not have.

How do you file an ICANN transfer complaint?

Use the transfer form on ICANN's Contractual Compliance complaint page. According to ICANN's transfer complaint guide, you enter the complete domain name, select the reason for the complaint and describe the steps you have taken to resolve it. The guide lists a registrar that does not respond after five days, a rejected transfer and an unauthorized transfer among the situations that call for one. Attach your timestamped emails.

Know the limits before you file. ICANN enforces the registrar's contract. It will not return a lost domain, will not settle a fee dispute and has no authority over country-code domains. We could not find a published response time, so file early and keep the domain renewed while the complaint runs.

Can you dispute a registrar's fee with your credit card issuer?

Possibly, and the clock is short. Under the Fair Credit Billing Act, the card issuer must receive your written notice of a billing error within 60 days after it sent the first statement showing the error, per 15 U.S.C. 1666. The FTC says to write to the issuer's billing-inquiries address, not the address for payments. A billing error includes a charge for services not delivered in accordance with the agreement made at the time, so a "processing fee" you never agreed to may qualify. The issuer decides.

Two cautions. First, the federal billing-error rules cover consumer credit. Regulation Z exempts credit extended primarily for a business purpose from most of its requirements, so a business card may follow only the issuer's own dispute terms. Second, dispute only the contested fee. The Transfer Policy lists credit card charge-backs as non-payment that lets a registrar deny a transfer, so charging back the registration itself can hand it a legitimate reason to hold the domain.

What if the registrar still won't release the domain?

Start by confirming who the registrar of record is. ICANN advises finding your registrar through a WHOIS search and dealing with it directly first, because the support page you have been writing to may belong to a reseller. Then put the specific Transfer Policy section in writing and file the ICANN complaint if the five days have passed.

If the registrar has stopped responding altogether, the situation is different, and what happens when a domain registrar shuts down covers it.

Beyond that, the options narrow. ICANN says it cannot return a lost domain, and a UDRP or court order is a mandatory reason to block a transfer, not a way to unblock one. If a registrar is holding a domain that matters to your business, get legal advice in your jurisdiction while the complaint and any card dispute run.

How do you keep an exit open across a portfolio of domains?

Every step above gets harder when you have to reconstruct the facts under pressure. The fix is to write them down per domain before you need them. If your names sit at five registrars, that is five dashboards, five lock states and five sets of dates.

SiteWarming's domain management tool is built for the portfolio problem. The guide to managing domains across multiple registrars shows the whole portfolio in one dashboard regardless of where each name is registered. You add domains by hand, import a CSV or connect a registrar, and get reminders at 90, 60 and 30 days before each expiration. The free plan tracks up to 1,000 domains, and the pricing page has the plan details. It does not replace the exit file above, but it keeps every expiry date where you will see it. How it differs from a registrar's own dashboard is laid out in SiteWarming vs. a registrar dashboard, and the domain health check covers ownership, access and renewal risk for a single name.

A domain that leads nowhere is the one nobody checks until it is locked. Launch & Warm, described on the how it works page, puts hosting, structured content and a protected contact path on a domain, so the owner decides whether to build, partner or take an offer. A domain with a purpose is one you will notice, and one you can move on your own schedule.

Frequently asked questions

Can a registrar legally refuse to transfer my domain?

Only for reasons ICANN's Transfer Policy lists. A registrar may deny a transfer for fraud, a dispute over who holds the domain, unpaid fees for the current term, your own objection, or a 60-day lock. It must deny during a UDRP, URS or court order. Any other refusal falls outside the policy.

Can a registrar charge a fee to transfer my domain out?

Yes. ICANN's FAQ for registrants says registrars set their own prices for the transfer service, so some charge. But a transfer cannot be denied for non-payment of that fee. ICANN also says it does not handle overbilling or transfer-fee complaints, so a disputed fee goes to the registrar or your card issuer.

How long does a registrar have to give me my transfer code?

Five calendar days from your request, but only if the registrar gives you no way to generate the code and unlock the domain yourself. If your dashboard offers self-service, the five-day rule does not apply. A registrar also may not withhold the code solely because you dispute a payment with it.

Why is my domain locked for 60 days?

Two rules can cause it. A registrar may deny a transfer within 60 days of a domain's creation date or of a previous registrar transfer. A material change to the registrant's name, organization or email also triggers a 60-day lock unless you opted out beforehand. Typo corrections do not count as material changes.

Do ICANN's transfer rules apply to .uk, .io and other country-code domains?

No. ICANN's Transfer Policy covers generic top-level domains such as .com, .net and .org. ICANN's complaints page says it has no contractual authority over country-code domains such as .us, .eu or .ac, so transfer, lock and fee rules for those come from the country's own registry and your registrar's terms.

Does a UDRP complaint freeze my domain?

Yes. When a trademark owner files a UDRP complaint, the registrar must lock the domain within two business days of the provider's verification request, and you cannot change registrars while the case is pending. WIPO says a case normally finishes within two months. The panel can only transfer or cancel the domain.

How do I file a complaint with ICANN about a registrar?

Use ICANN's Contractual Compliance transfer complaint form. Give the full domain name, select the reason, and describe the steps you took to resolve it. File it if the registrar has not unlocked the domain or given you a reasonable way to unlock it within five days of your request. ICANN cannot return a lost domain.

Can I dispute a registrar's fee with my credit card company?

Possibly. For a consumer credit card, the issuer must receive your written dispute within 60 days after it sent the first bill showing the error. Business-purpose cards are generally outside those federal billing-error rules, so check your issuer's terms. A chargeback on the registration itself can also count as non-payment and block a transfer.

What happens to a domain that expires while I am fighting a transfer?

It can move into a 30-day Redemption Grace Period, during which the registry prohibits transfers and DNS resolution stops. You must restore it through your current registrar, often for an extra fee, before transferring. ICANN's policy requires registrars to display redemption fees, so find the amount before the date arrives.

Related reading

• What Happens When a Domain Registrar Shuts Down?: what ICANN does when a registrar fails.
• How to Transfer a Domain Without Breaking Everything: the full transfer walkthrough, including DNS and email.
• Do You Actually Own Your Domain?: what a registration is, and what ICANN's rules cover.
• What Actually Happens When Your Domain Expires: the expiry timeline, day by day.
• Domain Registrar vs Web Host: why registration and hosting belong at different companies.
• Best Domain Registrars for Long-Term Ownership in 2026: how registrars compare for domains you plan to keep.
• WHOIS Privacy and Domain Protection: What's Free, What's a Scam: whether a paid protection tier is worth it.